News

Google Improves 'Native Client' for HTML 5 Web Apps

• By Kurt Mackie
• August 12, 2011

Google announced on Thursday that it has released a new beta of its Native Client (NaCl) plug-in, which is integrated into its Chrome browser.

NaCl promises to save developers from having to rewrite their C or C++ modules for Web apps running on x86 hardware. The technology is notable for executing those modules on the client side, which improves application performance vs. compiling machine code on the server side. NaCl uses the C-based Pepper Plugin Application Programming Interface (PPAPI), or "Pepper," to connect with HTML 5 capabilities in Google Chrome.

Originally, NaCl was conceived as a Netscape Plugin Application Programming Interface (NPAPI) for Chrome, Firefox, Safari and Opera browsers. Later, it was "integrated into Chrome 5 as an in process Pepper plugin," according to Google's wiki. The Chrome browser is currently released at version 13. NaCl is supported on Chrome for the Linux, Mac and Windows operating systems, according to Google's NaCl SDK Technical Overview.

Google claims that its sandbox technology provides security for running C and C++ "native code" in a browser. For instance, the NaCl's runtime prevents the code from "manipulating devices or files directly" or "directly accessing the operating system," according to the overview. Security was one of the main concerns Google had when it first launched NaCl about two-and-a-half years ago.

Al Hilwa, program director for applications development software at IDC, described NaCl's security approach as a "double sandbox" technique. He suggested it may provide just as much security as found with the use of JavaScript in a browser.

"Security issues will always surprise us, but this technique is conceptually no more dangerous than using JavaScript," Hilwa explained in an e-mail correspondence. "Of course, there are always bugs and vulnerabilities that no one plans for, and malware writers can always ask users to click to approve the infection in disguise, which is how most machines get infected in the first place."

Google is just focusing on C and C++ native code with this NaCl release, but the techniques could be used with other development platforms. Hilwa speculated that Microsoft could roll out something similar with Windows 8.

"The approach will allow Web apps to take more and more turf from other native platforms for certain types of applications, such as games or apps that use various components such as camera or microphone," Hilwa wrote. "Currently, there is no easy way to embed native code in other browsers except through plugins. However, I am going to predict that Windows 8 will have similar extensibility through IE when it ships, but that is just a guess."

The SDK (apparently released in late July) provides a compiler, as well as APIs and examples showing how C and C++ modules can work with HTML and JavaScript code in the browser. Recommended development tools include Eclipse for C or C++ or Xcode for Mac OS X. Google is planning Microsoft Visual Studio support for a future release, according to its NaCl FAQ.